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Why GAO Did This Study 

Since September 11, 2001, concern 
has increased that terrorists could 
smuggle weapons of mass 
destruction in the 7 million ocean 
containers that arrive annually at 
U.S. seaports. In response to this 
concern, the U.S. Customs Service 
(Customs) implemented the 
Container Security Initiative (CSI) 
to screen for high-risk containers at 
overseas ports and Customs-Trade 
Partnership Against Terrorism (C- 
TPAT) to improve global supply 
chain security in the private sector. 
GAO (1) describes the purpose and 
elements of these new programs, 
(2) examines Customs' 
implementation of CSI and C-TPAT 
during the first year, and (3) 
assesses the extent to which 
Customs has focused on factors 
critical to the programs' long-term 
success and accountability. 



What GAO Recommends 



To ensure that CSI and C-TPAT 
achieve their long-term objectives, 
GAO recommends that the 
Secretary of Homeland Security, 
working with the Commissioner of 
Customs and Border Protection 
and managers for both programs 

• develops human capital plans 
that clearly describe how the 
programs will recruit, train, 
and retain staff; 

• expands efforts to develop 
performance measures that 
include outcome-oriented 
indicators; and 

• develops strategic plans that 
clearly lay out the programs' 
goals, objectives, and 
implementation strategies. 

www.gao.gov/cgi-bin/getrpt7GAO-03-770. 

To view the full product, including the scope 
and methodology, click on the link above. 
For more information, contact Loren Yager at 
(202) 512-4347 or yagerl@gao.gov. 



What GAO Found 

Announced in January 2002, CSI places Customs staff at designated foreign 
seaports to screen containers for weapons of mass destruction. In November 
2001, Customs also initiated C-TPAT, in which private companies improve 
the security of their supply chains in return for the reduced likelihood that 
their containers will be inspected for weapons of mass destruction. 

Customs quickly implemented both programs in the first year. It concluded 
bilateral arrangements with foreign governments to place Customs 
personnel at 24 foreign ports and deployed staff to 5 of these ports under 
CSI, and it enrolled more than 1,700 companies in C-TPAT. Customs is 
developing critical program elements intended to ensure that C-TPAT 
companies improve and maintain their security practices. GAO found that 
Customs' implementation of these programs evolved in response to 
challenges it encountered. 

Although Customs is preparing to devote significantly more resources to CSI 
and C-TPAT as it expands the programs, it has not taken adequate steps to 
incorporate factors necessary for the programs' long-term success and 
accountability. These factors include human capital planning, development 
of performance measures, and strategic planning. GAO found the following: 

• Although CSI seeks to staff Customs officials at more than 30 overseas 
ports and C-TPAT expects to hire more than 150 additional staff, 
Customs has not devised systematic human capital plans to meet long- 
term staffing needs for both programs. 

• While Customs has created some performance measures to quantify 
operational activities and efforts, it has not developed measures to 
establish accountability and measure program achievement. 

• In its efforts to rapidly implement the programs and enroll participants, 
Customs focused on short-term planning. Customs lacks a strategic plan 
that would allow it to establish accountability for approximately $73 
million in planned expenditures for fiscal year 2004. 

Budgets and Anticipated Growth for CSI Ports and C-TPAT Staff, Fiscal Years 2002 and 2004 
CSI budget in millions of dollars C-TPAT budget in millions of dollars 
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July 25, 2003 



The Honorable Charles E. Grassley 
Chairman, Committee on Finance 
United States Senate 

The Honorable Max Baucus 

Ranking Minority Member, Committee on Finance 
United States Senate 

The Honorable Bill Thomas 

Chairman, Committee on Ways and Means 

House of Representatives 

The Honorable Charles B. Rangel 

Ranking Minority Member, Committee on Ways and Means 
House of Representatives 

Ocean containers play a vital role in the movement of cargo between global 
trading partners. In 2002, more than 7 million ocean cargo containers 
arrived at U.S. seaports. Responding to heightened concern about national 
security since September 11, 2001, several U.S. government agencies have 
acted to prevent terrorists from smuggling weapons of mass destruction 
(WMD) in cargo containers from overseas locations to attack the United 
States and disrupt international trade. Because of its frontline 
responsibilities for inspection at U.S. ports of entry, the U.S. Customs 
Service 1 assumed the lead role in improving ocean container security and 
reducing the vulnerabilities associated with the overseas supply chain. By 
January 2002, Customs had initiated the Container Security Initiative (CSI) 
and Customs-Trade Partnership Against Terrorism (C-TPAT) to enhance 
the security of the global supply chain and deter international acts of 
terrorism, as well as facilitate the smooth passage of commerce across U.S. 
borders. The purpose of CSI is to enable Customs to screen for high-risk 
containers in key ports overseas, while the purpose of C-TPAT is to 
improve global supply chain security in the private sector. 



x On March 1, 2003, the U.S. Customs Service was transferred to the new Department of 
Homeland Security. The border inspection functions of the Customs Service, along with 
other U.S. government agencies with border protection responsibilities, were organized into 
the Bureau of Customs and Border Protection. Throughout this report, we will use the term 
"Customs" to refer to both the Customs Service and the Bureau of Customs and Border 
Protection. 
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In response to your interest in Customs' efforts to counter potential threats 
posed by ocean containers as they move through the global supply chain, 
we have (1) described the purpose and program elements of the new CSI 
and C-TPAT programs, (2) examined Customs' implementation of the 
programs during the first year, and (3) assessed the extent to which 
Customs has focused on factors critical to the programs' long-term success 
and accountability 

To address our objectives, we met with U.S. Customs officials in 
Washington, D.C., with program responsibilities for CSI and C-TPAT. We 
also met with private companies and industry associations in the United 
States to learn how C-TPAT affects the private sector. To learn about 
Customs' early experiences with CSI, we visited Canada, the Netherlands, 
and France, the countries where CSI was first implemented, to meet with 
the U.S. Customs attaches responsible for managing the implementation in 
the ports of Vancouver, Rotterdam, and Le Havre, respectively. We also met 
with members of the CSI team deployed at these three ports. In addition, 
we interviewed officials representing the governments of Canada, the 
Netherlands, and France who were involved in CSI negotiations and 
implementation. We also spoke with private sector officials in these 
countries to understand their perspectives on both CSI and C-TPAT. In 
addition, we reviewed Customs' Web site for information on the programs' 
status and activities. Finally, we used GAO reports on factors critical to the 
long-term success of organizations such as the Department of Homeland 
Security (DHS). Our methodology primarily relied on interviews with 
knowledgeable officials because both programs are new and Customs was 
not able to provide documentation regarding many of the issues that were 
the subject of our review. (For additional information on our scope and 
methodology, see app. I.) 



RGSllltS in Bllef Customs developed CSI and C-TPAT in response to security vulnerabilities 

created by ocean container trade and to the concern that terrorists could 
exploit these vulnerabilities to transport or detonate WMDs in the United 
States. Announced in January 2002, CSI allows U.S. Customs to screen 
containers at CSI-designated foreign seaports. Placement of a CSI team 
overseas allows Customs to work with foreign customs officials to identify 
and examine high-risk containers prior to their arrival at U.S. ports. 
Customs initially targeted the top 20 foreign ports that shipped 66 percent 
of total containers to the United States for CSI inclusion, and then 
expanded the program to additional strategic ports. In November 2001, 
Customs initiated C-TPAT to improve the security of containers as they 
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move through the global supply chain. Under C-TPAT, Customs officials 
work in partnership with private industry, reviewing supply chain security 
plans and recommending improvements. In return, C-TPAT members 
receive the benefit of a reduced likelihood that containers traveling along 
their supply chains will be inspected for WMDs. For fiscal year 2003, the 
CSI budget is about $28 million, and the C-TPAT budget is about $9 million. 
These budgets combined are expected to increase to more than $73 million 
for fiscal year 2004 as the programs expand. 

During the first year, Customs quickly designed and rolled out CSI and C- 
TPAT, modifying operations over time. Customs achieved strong 
participation among the countries and companies, respectively, that it 
sought to enroll in CSI and C-TPAT. In CSI's first year, Customs reached 
agreement with 15 governments to place Customs personnel at 24 ports 
and placed four or five-member CSI teams in 5 of these ports. 2 In C-TPAT's 
first year, more than 1,700 companies agreed to participate in the program, 
and most received the key benefit, a reduced likelihood of inspections for 
WMDs. As participation in these programs grew, Customs implementation 
evolved in response to challenges as they arose. For example, the first CSI 
team deployed in Europe discovered that critical information that it needed 
from the host customs administration was not readily available and, as a 
result, the CSI team was unable to achieve its goal of thoroughly screening 
containers overseas. To address this challenge, Customs implemented a 
"24-Hour Rule" requiring carriers to supply key information directly to 
Customs. Similarly, Customs initially expected that its account managers, 
who had experience working with the trade community, would recruit new 
C-TPAT members and assist companies with the development of their 
action plans. However, Customs later realized that C-TPAT needed staff 
with greater knowledge of supply chain security to help with the action 
plans as well as assist with other program elements. In response, Customs 
created a new supply chain specialist position, which was announced in 
May 2003. These supply chain specialists will play a key role in 
implementing critical program elements designed to ensure that member 
companies are improving and maintaining supply chain security practices. 



2 The United States and Canada do not have a CSI arrangement covering three of these five 
ports because the Smart Border Accord, which was signed in December 2001, governs the 
placement of Customs personnel at three Canadian seaports, and preceded the 
announcement of CSI. However, Customs refers to these seaports as CSI ports. 
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Customs' management and operations of CSI and C-TPAT to date show that 
Customs has not taken adequate steps to incorporate factors crucial to the 
programs' long-term success and accountability. More than 1 year into the 
implementation of CSI, Customs has not developed a systematic human 
capital plan to recruit, train, and assign the more than 120 CSI program 
staff that may be needed for long-term assignments in a wide range of 
foreign ports, some of which may require unique language capabilities and 
diplomatic skills. Likewise, Customs has not developed such a plan to 
govern the planned 15-fold expansion of C-TPAT, from a 10-person 
organization to one with more than 160 staff positions. Without human 
capital plans, Customs may be unable to anticipate potential challenges 
and put in place the workforce needed to implement CSI and C-TPAT in a 
timely manner. Similarly, Customs lacks performance measures that 
demonstrate program achievements and establish accountability, although 
they are tracking elements such as the number of countries and companies 
involved in CSI and C-TPAT. For example, the existing performance 
measures do not assess how CSI's presence overseas helps improve the 
targeting of high-risk containers beyond Customs' existing capabilities. In 
addition, Customs has not developed any effective indicators to ascertain 
whether C-TPAT has had an impact on the members' supply chain security 
practices. Without indicators that measure program outcomes, Customs 
may not be able to accurately assess the programs' success or establish a 
basis for program oversight. Finally, Customs' focus on short-term 
operational planning in order to quickly implement the programs impeded 
its ability to systematically carry out strategic planning. As a result, 
Customs lacks elements of strategic planning that would improve the 
management of the programs and allow Customs to establish 
accountability for approximately $73 million in planned expenditures for 
fiscal year 2004. 

This report makes recommendations to the Secretary of the Department of 
Homeland Security to improve the management and oversight of CSI and C- 
TPAT as they expand by developing human capital plans that will drive 
future recruitment, training and retaining strategies, expanding on existing 
performance measures to reflect outcome-oriented indicators, and 
developing strategic plans that clearly lay out the programs' goals, 
objectives, and detailed implementation strategies. Customs agreed with 
our recommendations and overall observations that it needs to take 
adequate steps to incorporate human capital planning, expand efforts to 
develop performance measures and develop strategic plans — factors 
necessary for the long-term success and accountability of CSI and C-TPAT. 
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Background. Ocean-going cargo containers are a critical link in the system of global 

trade. With the rise of the "just-in-time" delivery system, which allows 
companies to reduce their inventories, as well as the efficiencies of the 
maritime transportation system, the U.S. and world economies have 
become increasingly reliant on the cargo container to transport their 
goods. In fact, approximately 90 percent of the world's trade moves by 
cargo container. Although these containers arrive from various ports 
throughout the world, about 49 percent of U.S.-bound containers arrive 
from the top 10 international ports listed in table 1. 





Table 1: Top 10 Foreign Ports, by Number of U.S.-bound Containers, 2001 


Foreign ports 


Number of U.S.- 
bound containers 


Percentage of total 
containerized U.S.-bound 
cargo, by volume 


Hong Kong, China 


558,600 


9.8 


Shanghai, China 


330,600 


5.8 


Singapore 


330,600 


5.8 


Kaohsiung, Taiwan 


319,200 


5.6 


Rotterdam, The Netherlands 


290,700 


5.1 


Pusan, South Korea 


285,000 


5.0 


Bremerhaven, Germany 


256,500 


4.5 


Tokyo, Japan 


159,600 


2.8 


Genoa, Italy 


119,700 


2.1 


Yantian, China 


114,000 


2.0 


Total (top 1 ports) 


2,764,500 


48.5 



Source: GAO analysis of Customs data. 

Note: Number of containers has been rounded. 



In 2002, roughly 7 million containers entered U.S. seaports. About 87 
percent of these ocean containers entered 10 U.S. seaports, as shown in 
table 2. More than half — approximately 58 percent — of ocean container 
arrivals are concentrated in three of the largest U.S. ports: Los Angeles, 
Long Beach, and New York-New Jersey. 
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Table 2: Top 10 U.S. Ports, by Number of U.S.-bound Containers, 2002 


U.S. ports 


Number of U.S.- 
bound containers 


Percentage of total containerized U.S.- 
bound cargo, by volume 


Los Angeles 


1,774,000 




24.7 


Long Beach 


1,371,000 




19.1 


New York-New Jersey 


1 ,044,000 




14.6 


Charleston 


376,000 




5.2 


Savannah 


312,000 




4.3 


Norfolk 


306,000 




4.3 


Seattle 


284,000 




4.0 


Tacoma 


273,000 




3.8 


Oakland 


268,000 




3.7 


Houston 


233,000 




3.3 


Total (top 1 0) 


6,241,000 




87.0 



Source: GAO analysis of Port Import Export Reporting Service (PIERS) data as reported by U.S. Maritime Administration. 

Note: Number of containers has been rounded. 



According to research initiated by the U.S. Department of Transportation's 
Volpe National Transportation Systems Center (Volpe), cargo security is 
affected by the number of individual companies contracted to facilitate the 
handling and movement of cargo through its supply chain. 3 To move a 
container from production facilities overseas to distribution points in the 
United States, an importer faces various choices regarding the logistical 
process such as routes and the selection of freight forwarders. For 
example, importers can own and operate key aspects of the overseas 
supply chain process, such as warehousing and trucking operations. 
Conversely, importers can contract with logistical service providers, such 
as freight consolidators and nonvessel operating common carriers. 4 In 
addition, importers must choose which modes of transportation to use, 
such as rail, truck or barge, to move containers from the manufacturer's 
warehouse to the seaport of lading. According to this Volpe study, 



3 DOT Volpe National Transportation Systems Center, Intermodal Cargo Transportation: 
Industry Best Security Practices (Cambridge, Massachusetts: June 2002). 

4 A freight consolidator is a firm that accepts partial container shipments from individual 
shippers and combines the shipments into a single container for delivery to the carrier. A 
nonvessel operating common carrier is a company that buys shipping space, through a 
special arrangement with an ocean carrier, and resells the space to individual shippers, 
instead of receiving a commission. 
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importers who own and operate the entire supply chain route from start to 
finish suffer the least amount of security breaches because they have 
greater control over their supply chains. Figure 1 depicts basic 
characteristics of the overseas portion of the supply chain and some areas 
of vulnerability to terrorists intent on placing a WMD in a container. 



Figure 1: Steps in Supply Chain and Some Points of Potential Vulnerability 




Overseas warehouse loading a container for export 

Potential vulnerability: Warehouse facilities may have weak controls and personnel practices. For example, access to 
shipping areas may not be secure and warehouse personnel practices may lack sufficient background checks. Also, 
seals attached to containers may provide minimum security against tampering. 







Step 5 







Contracted trucking company 
preparing to leave warehouse 
for port terminal 
Potential vulnerability: Visibility 
of in-transit activities may not be 
apparent to the trucking company 
or the supplier. The location of 
the truck and container may not 
be known or tracked. 
Furthermore, truck drivers may 
have broad discretion over their 
routes, which are subject to last 
minute changes. 

Source: GAO analysis of Department of Transportation information. Photograph in Step 5, Port of Long Beach. 



Port terminal receives 
container and stages it for 
vessel loading 

Potential vulnerability: Terminal 
operators may not adequately 
screen employees for criminal 
backgrounds. Some containers 
may be at risk for tampering 
because the container may sit for 
extended periods before being 
staged and loaded on a cargo ship. 



Ocean carrier loads container 
for trans-oceanic voyage 
Potential vulnerability: 

Containers might not have a seal 
or show signs of tampering. The 
ocean carrier and terminal 
operator may not routinely check 
containers for seals or signs of 
container tampering prior to or 
during the loading of the container 
on the ship. 



Ocean carrier en-route to 
multiple ports 
Potential vulnerability: 

Container ship may make multiple 
stops at various seaports to 
unload and load containers. The 
container ship transits through 
various routes and ports posing 
different levels of security risks. 
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A report prepared by the National Defense University's Center for 
Technology and National Security Policy states that an ocean container 
itself is ideally suited to deliver a WMD. 5 The likelihood that a terrorist will 
use a container to deliver a WMD depends on the type of WMD and the 
likelihood an ocean container would be used as the means of delivery. 
These researchers believe that it is feasible for a terrorist group to make a 
radiological "dirty bomb" which uses standard explosives to disperse 
radiological material, and that the ocean container would provide an ideal 
mode of transportation. On the other hand, these researchers have 
concluded, a terrorist attack using a nuclear WMD has a much lower 
feasibility because it is deemed less probable that terrorists have the 
resources and technical ability to build or obtain a workable nuclear 
weapon at this time and the nuclear WMD might be too valuable an asset to 
relinquish control by shipping it in a container. But some experts agree 
that the possibility of terrorists smuggling a nuclear WMD by ocean 
containers merits attention because the consequences would be much 
more severe than those of other types of WMDs. While there have been no 
known incidents of containers being used to transport WMDs, criminals 
have exploited containers for other illegal purposes, such as smuggling 
weapons, people, and illicit substances. Such activities demonstrate the 
vulnerability of the freight transportation industry and suggest 
opportunities for further exploitation of containers by criminals, including 
terrorist groups. 

Various experts have estimated that the cost to the U.S. economy of port 
closures due to the discovery or detonation of WMDs could be significant. 
For example, in May 2002, the Brookings Institution estimated that costs 
associated with U.S. port closures resulting from a detonated WMD could 
amount to $1 trillion. 6 Estimating the cost of discovering an undetonated 
WMD at a U.S. seaport, Booz, Allen and Hamilton reported in October 2002 
that a 12-day closure would cost approximately $58 billion. 7 



5 National Defense University, The Virtual Border: Reducing the Risk of Seaborne 
Container Terrorism (Washington, D.C.: August 2002). 

6 Brookings Institution, Protecting the American Homeland: A Preliminary Analysis, 
Michael O'Hanlon, et al. (Washington, D.C.: 2002). 

7 Mark Gerencser, Jim Weinberg, and Don Vincent, Port Security War Games: Implications 
for U.S. Supply Chains, (Booz, Allen and Hamilton, 2002). 
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Key Customs Programs 
Developed to Address 
Container Security 



Customs developed CSI to detect and deter acts of container-related 
terrorism at the earliest point feasible along the supply chain, and it 
developed C-TPAT to address concerns about supply chain vulnerabilities. 
CSI placed Customs officials in key foreign ports to detect WMDs in 
containers prior to their arrival to the United States and to deter terrorists 
from using containers to deliver a WMD. 8 C-TPAT established a partnership 
between the private sector and Customs to improve the overall security of 
international supply chains, offering participating companies the incentive 
that their containers will have a lower chance of being inspected for 
WMDs. For fiscal year 2003, CSI's budget is about $28 million, and C- 
TPAT's budget is about $9 million. Customs has proposed budget 
increases, combined total of $73 million, for fiscal year 2004 to support the 
programs' expansion plans. 



CSI Placed Customs 
Officials Overseas to Screen 
Containers 



Announced in January 2002, CSI allows Customs to screen for high-risk, 
U.S.-bound containers at key foreign ports, 9 a task previously carried out 
only at U.S. seaports. To do this, Customs negotiates and enters into 
bilateral arrangements with foreign governments. These arrangements 
contain common language that specifies the placement of Customs 
officials, on a pilot basis, at foreign ports and the exchange of information 
between U.S. Customs and foreign customs administrations. Customs first 
targeted for CSI the 20 foreign ports that shipped the highest volume of 
ocean containers to the United States. These top 20 ports are located in 14 
nations and shipped a total of 66 percent of all containers that arrived in 
U.S. seaports in 2001. Customs also plans to expand CSI to an additional 20 
to 25 strategic ports that ship a significant volume of containers to the 
United States and are considered to be strategic locations. According to 
Customs, these strategic ports must meet minimum requirements such as 
having nonintrusive inspection equipment and having customs officials 



8 CSI has two other program components: the use of detection technology to inspect high- 
risk containers and the use of technology to secure containers. However, these components 
were outside the scope of our review. We have conducted previous work in the area of 
inspection technology. See U.S. General Accounting Office, Homeland Security, Title III of 
the Homeland Security Act of 2002: Addendum, GAO-02-930T (Washington D.C.: July 9, 
2002). In a separate effort, an interagency Container Working Group, co-chaired by 
Department of Transportation and Customs, is currently working on improving the physical 
security of the container. 

9 The CSI ports are generally the last foreign ports of lading before vessels arrive into U.S. 
seaports. 
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capable of conducting inspections to support the CSI program. Customs 
proposed to increase CSI's budget from $28.4 million in fiscal year 2003 to 
$61.2 million in fiscal year 2004. 

CSI Operations To prepare a CSI team for deployment overseas, Customs sends an 

assessment team to the CSI port to collect information about the port's 
physical and informational infrastructure and the host country's customs 
operations. Customs then deploys a CSI team of approximately four to five 
Customs officials to work with the host country's customs administration 
to identify high-risk containers departing from these ports for the United 
States. 10 Containers targeted for CSI inspection arrive at CSI ports by land, 
rail, or sea en route to the United States. The CSI team uses Customs' 
Automated Targeting System to screen container data and identify high-risk 
containers for inspection. 11 This system evaluates U.S.-bound cargo 
manifest data electronically and determines a container's risk level. 12 To 
improve its screening capabilities, the CSI team further analyzes U.S.- 
bound containers by means of data provided by host countries' customs 
administration. Host countries' customs officials then inspect containers 
that both U.S. and host customs officials identify as high risk. Although the 
arrangements do not specify that U.S. Customs officials must be able to 
observe inspections, Customs officials told us that a central tenet of the 
CSI concept is that U.S. Customs inspectors be able to observe and verify 
the inspections and that all partner Customs administrations accept this 
tenet. 

According to Customs officials, the most important benefits of CSI derive 
from the collocation of U.S. Customs officials with foreign customs 
officials. Prior to the implementation of CSI, Customs officials in U.S. ports 
screened container data using the Automated Targeting System and 
inspected high-risk containers on their arrival in the United States. With 



10 The CSI program includes a reciprocity option for partner governments that allows foreign 
customs administrations to station officers at U.S. seaports. As of May 2003, two countries 
have placed customs officers at U.S. seaports: Canada and Japan. 

n In a separate review, GAO is currently assessing Customs' Automated Targeting System 
and its overall ability to identify and process cargo containers considered to be "high risk" 
for terrorism. 

12 A manifest is a document that lists in detail the total cargo of a vessel and is issued by a 
carrier or its agent or master for a specific voyage. Examples of data elements in a manifest 
include shipper, consignee, point and country of origin of goods, export carrier, port of 
lading, port of discharge, description of packages and goods, and date of lading. 
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the placement of officials overseas, Customs expects that the added value 
of real-time information sharing will improve Customs' ability to target 
high-risk containers. For example, using the Automated Targeting System, 
U.S. Customs officials may identify unfamiliar consignees that have been 
flagged as high risk but are later determined not to be high risk based on 
the host customs' knowledge and experiences. Customs' presence 
overseas is intended to help ensure that containers identified as high risk 
are inspected prior to arrival in the United States. In addition, Customs 
officials hope that the collocation of its officials with foreign customs 
officials will result in relationships that enhance cooperation and 
intelligence sharing. 

Customs officials believe that CSI should facilitate the flow of trade to the 
United States and could reduce the processing time for certain shipments, 
because the screening at CSI ports will in most cases take place during 
"down time" while containers wait at the port terminal prior to being 
loaded onto vessels. In addition, CSI eliminates the necessity of inspecting 
containers for security purposes, absent additional information affecting 
their risk analyses, when they reach the United States. CSI also offers 
benefits to foreign ports that participate in the program, including 
deterrence of terrorists that may target their ports and a shorter time frame 
to resume operations in the event of a catastrophic incident. 

CSI Staffing Customs created an intra-agency task force to manage and operate the 

program, headed by Customs' Office of International Affairs and staffed 
with representatives from different offices within Customs. 13 In addition, 
the assessment teams that travel to CSI ports to survey the operational 
needs comprise members from these various offices. Customs officials 
state that Customs relies on its overseas attaches to facilitate CSI 
negotiations with foreign governments, oversee CSI operations at one or 
more CSI ports, 14 and report CSI operations to the task force, in addition to 
their existing Customs duties. 

Each CSI team deployed at a foreign port consists of four to five team 
members: two to three inspectors from Customs' Office of Field 



13 The CSI Task Force consists of individuals from Customs offices, such as the Offices of 
International Affairs, Field Operations, Intelligence, Information and Technology, and 
Training and Development. 

"For example, the Attache in France is responsible for Customs operations in Belgium, 
France, and Spain. 
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Operations, one intelligence research analyst, and one agent serving as a 
CSI team leader representing the Office of Investigations. (See fig. 2.) 
According to Customs officials, while Customs inspectors review container 
data using the Automated Targeting System and seek assistance from local 
customs to screen containers, the intelligence analyst conducts further 
analyses using additional research tools and real-time information sharing 
with local customs' intelligence analysts. The team leader serves as a 
liaison between the CSI team and the foreign customs administration and 
reports to the Customs Attache regarding CSI operations. Currently, each 
CSI team is assigned to a foreign port under a temporary duty assignment 
and is replaced by other Customs personnel after a 120-day period. 
However, Customs officials told us that they are currently seeking to 
convert these temporary positions to permanent CSI staff positions at 
foreign ports. 



Figure 2: CSI Task Force Organization Chart, March 2003 



Office of 
Information 
and Technology 



Office of 
Training and 
Development 




Office of 
Investigations 



Source: GAO analysis of Customs information. 



Page 12 



GAO-03-770 Container Security 



CSI Funding The budget for the CSI program is expected to grow as the program 

expands, as shown in table 3. In fiscal year 2002, Customs spent about $3.3 
million, using emergency supplemental no-year funds to support 
preliminary CSI needs. 15 These funds were budgeted for such needs as 
travel to promote the program to foreign customs, the purchase of 
computer equipment for CSI ports, and the maintenance of a CSI team in 
Rotterdam. Customs' fiscal year 2003 budget is approximately $28.4 million 
to support CSI operations in an anticipated 21 foreign ports and conduct 
assessments of 6 additional ports. As of March 2003, Customs had spent 
$3.4 million of fiscal year 2003 funds to support operations in 9 ports. As 
part of the new DHS budget, Customs requested $61.2 million to support 
anticipated CSI operations in 30 foreign ports in fiscal year 2004. 





Table 3: CSI Budget Plans and Obligations, Fiscal Years 2002-2004 


Fiscal year 


CSI budget plan 


Budget amount 


Obligations 


2002 


Operate in 1 port and 
conduct 
assessments in 
additional ports. 3 


$4.3 million 


$3.3 million 13 


2003 


Operate in 21 ports 
and conduct 
assessments in 6 
additional ports. 


$28.4 million 


$3.4 million 
(as of 3/14/03) 


2004 


Operate in 30 ports. 


$61.2 million proposed 


Not applicable 



Source: GAO analysis of Customs information. 



a The budget plan for FY 2002 does not include funds for CSI operations in the 3 Canadian ports 
because these were funded separately until fiscal 2003, when they were combined into the overall CSI 
program. 

These funds were expended. 



15 Emergency supplemental funds were provided to Customs under P.L.107-117. The fiscal 
year 2002 amounts do not include the costs of operating in three Canadian ports, which 
were funded separately by Office of Field Operations. 
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Announced in November 2001, C-TPAT is a voluntary partnership program 
between the business community and Customs, designed to enhance the 
security of international supply chains and thus reduce the number of 
containers that otherwise might be screened for WMDs because of risk 
considerations. Customs plans to achieve these objectives by encouraging 
importers, freight forwarders, carriers, and other logistics service 
providers to improve security practices and to persuade their service 
providers along their supply chain to do the same. Customs accomplishes 
this through partnership agreements and by reviewing and following-up on 
company supply chain security profiles. In return, Customs offers a number 
of incentives, including the key benefit of a reduced likelihood of 
inspection for WMDs. 16 Customs is still developing critical aspects of the 
program intended to ensure that member companies respond to C-TPAT 
recommendations for improving and maintaining supply chain security 
practices. Like CSI, the budget for C-TPAT is expected to increase as the 
program expands. 

C-TPAT Operations Prior to recruiting C-TPAT members, Customs worked with industry 

leaders to develop a set of recommendations intended to improve the 
security practices for specific segments of the supply chain (e.g., 
air/sea/land carriers, customs brokers, importers, manufacturers, 
warehouses, freight forwarders, and domestic ports). The C-TPAT security 
recommendations are meant to serve as a guide for members to follow and 
are not mandatory. For example, a common C-TPAT recommendation 
encourages carriers, warehouses, importers, and manufacturers to affix, 
replace, record, track, and verify seals on containers, but its 
implementation is not obligatory. 

As a first step in C-TPAT membership, a company must sign an agreement 
with Customs signifying its commitment to enhance its supply chain 
security by embracing C-TPAT security recommendations and to work with 
its service providers throughout its supply chain to enhance security 
processes. At this point, the company becomes a C-TPAT member, and its 
risk score is partially reduced. 17 After signing the agreement, the company 



C-TPAT Works with Private 
Sector to Improve Supply 
Chain Security 



16 C-TPAT member companies are not exempt from Customs trade compliance and 
enforcement activities. 

"Specifically, Customs reduces a company's overall risk score in Custom's Automated 
Targeting System. A lower score indicates lower risk and a decreased likelihood of being 
inspected for a WMD. 
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is required to self-assess its supply chain security practices, using the C- 
TPAT industry security recommendations as a guideline, and document its 
observations in a security profile. The security profile is intended to be an 
executive summary of the company's current and future supply chain 
security practices and vulnerabilities, as well as an indication of how these 
recommendations were communicated to its business partners overseas. 

Using a checklist based on the C-TPAT recommendations, C-TPAT officials 
review the security profile to understand the company's security practices 
and decide whether to further reduce the company's risk score. To help 
complete their assessments of companies, C-TPAT officials also seek 
information from other Customs offices on the company's historic 
relationship with Customs, such as the results of trade compliance 
examinations or any past criminal investigations. Once any concerns that 
C-TPAT officials may have raised are resolved, Customs will further reduce 
the company's risk score. Through standard feedback letters, Customs 
notifies companies of the results of the review process and requests 
additional information on security practices. 

According to Customs, C-TPAT participants are never rejected from the 
program because of an inadequate security profile or for adverse 
information discovered during the review process. On the contrary, 
Customs officials say that they are committed to working with these 
companies, even if there are serious security or trade compliance 
weaknesses. However, Customs may, under certain circumstances, 
withhold or reduce C-TPAT benefits. Furthermore, Customs officials stated 
that they may remove a company from C-TPAT membership if they 
determine that its commitment is not serious or that it has intentionally 
misled Customs. 

Other program elements are intended to ensure that member companies 
have taken action to improve and maintain supply chain security practices. 
Customs intends to use validations to establish accountability by verifying 
that information on a company's security profile is accurate and complete. 
Customs intends to use action plans to communicate the weaknesses it 
identifies and outline the steps that companies need to take to strengthen 
their supply chains. Customs also plans to use annual assessments, or 
questionnaires, to follow up on a variety of open-ended security issues. 

C-TPAT Staffing Customs created a C-TPAT management team to oversee and implement 

the program. Currently, C-TPAT staff includes a director, four program 
managers, and five program officers, working at Customs' headquarters 
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and organized by trade sectors that cover all aspects of C-TPAT 
membership (see fig. 3). According to C-TPAT officials, program managers 
provide overall program direction and guidance, as well as program 
promotion within trade sectors. Program officers, with help from program 
managers, provide guidance to companies on how to complete their 
security profiles as well as review security profiles and prepare feedback 
letters. In addition to C-TPAT staff, account managers who are located at 
Customs sites across the country and manage a portfolio of companies on 
trade compliance matters, also assist with the C-TPAT program. 18 Over 300 
account managers promote the program and serve as points of contact for 
many companies seeking information about C-TPAT. 



Figure 3: C-TPAT Organizational Structure, May 2003 
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Source: GAO analysis of Customs information. 



18 Under the Office of Field Operations' Trade Compliance and Facilitation, account 
managers work with selected companies to help increase their level of trade compliance 
through one-on-one interaction. For companies that do not have an account manager, being 
designated an account and assigned an account manager is considered a benefit of joining 
C-TPAT. 
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C-TPAT Funding The budget for C-TPAT is expected to increase as the program expands. 

Funding for C-TPAT began in April 2002, with emergency supplemental no- 
year funds totaling $8.3 million. 19 According to Customs, it carried over 
unexpended funds to support a C-TPAT budget of $8.8 million for 
operations in fiscal year 2003. Customs' proposed C-TPAT budget for fiscal 
year 2004 is $12.1 million and includes a request for 157 security specialist 
positions. 20 Table 4 depicts budget plans and obligations for fiscal years 
2002 to 2004. 





Table 4: C-TPAT Budget Plans and Obligations, Fiscal Years 2002-2004 


Fiscal year 


C-TPAT budget plan 


Budget amount 


Obligations 


2002 


Program promotion, 
equipment, personnel, 
and other expenses. 


$8.3 million 


$184,694 


2003 


Program promotion, 
equipment, personnel, 
and other expenses. 


$8.8 million 


$4.7 million 
(as of 3/31/03) 


2004 


Program promotion, 
equipment, personnel, 
and other expenses. 


$12.1 million (proposed) 


Not applicable 



Source: GAO analysis of Customs information. 



Responding to concerns about container security, Customs quickly rolled 
out CSI and C-TPAT, adjusting its implementation of the programs to meet 
challenges. Early on, the programs enlisted the participation of many 
countries and companies, respectively. By January 2003, Customs had 
entered into bilateral arrangements with foreign governments to place 
Customs officials at 24 ports and soon deployed CSI teams to 5 of them. 
Similarly, by the end of C-TPAT's first year, Customs had recruited 
approximately 1,700 companies to become C-TPAT members, received 
security profiles from about half of these companies, and sent feedback 
letters to half of the companies submitting security profiles. As CSI and C- 
TPAT evolved, Customs adapted its implementation of the programs as it 



19 Emergency supplemental funds were provided to Customs under P.L. 107-117. 

20 Beginning in fiscal year 2004, C-TPAT is assuming greater level of responsibility for funding 
all of Customs industry partnership programs, such as the Business Anti-Smuggling 
Coalition and the Carrier Initiative Program. 



Customs Quickly 
Rolled Out CSI and 
C-TPAT, Adapting 
Programs to Meet 
Challenges 
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encountered challenges. For example, experiences at one of the first CSI 
ports of deployment showed Customs that it needed to change the way it 
collected the manifest data necessary for targeting high-risk containers and 
the way it selected staff for CSI assessment teams. Similarly, as Customs 
realized that its account managers, who were on the "front lines," were not 
prepared to provide companies the level of assistance they required, 
Customs developed a new supply chain specialist position to assist with 
key program elements and limited the role of account managers to 
promoting the program. These supply chain specialists will play a key role 
in ensuring that member companies are improving and maintaining supply 
chain security practices. 



In CSI's early stage of implementation, Customs entered into numerous 
bilateral arrangements with foreign governments to place Customs officials 
at CSI ports and soon deployed several CSI teams; however, at the port of 
Rotterdam, Customs found that logistical and legal challenges limited the 
CSI team's ability to obtain manifest data essential to screen high-risk 
containers. To ensure that it would obtain complete and timely manifest 
data, Customs implemented the 24-Hour Rule, which allows Customs to 
directly receive from carriers information necessary for screening 
containers overseas. In addition, after realizing that the early composition 
of CSI assessment teams and the survey instrument used by the teams were 
inadequate, Customs modified the teams by building in additional expertise 
and developed comprehensive and standardized port surveys. 

Most Target Governments During CSI's first year of implementation, Customs completed 

Agreed to CSI in First Year, Some arrangements with 15 governments to place officials at 24 seaports. First, 
CSI Teams Deployed Canada agreed to the placement of U.S. Customs personnel at 3 seaports 

under the Smart Border Declaration, which preceded the announcement of 
CSI. 21 Then, between January 2002 and January 2003, Customs concluded 
bilateral arrangements with 12 governments covering 18 of the 20 seaports 
that ship the highest volume of containers to the United States, as well as 2 
other governments representing 3 strategic ports. 

During the program's initial year, Customs deployed CSI teams to 5 ports, a 
few months after the arrangements were signed. As of May 2003, Customs 



21 U.S. Customs officials at Canadian seaports monitor containers shipped from Canada to 
the United States, as well as containers shipped from other foreign ports, off-loaded at 
Canadian ports, then transported to the United States by land. 



Many Countries Agreed to 
Join CSI; Program 
Modifications Made in 
Response to Early 
Challenges 
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had placed CSI teams at 7 additional ports. The number of CSI 
deployments as of May 2003 represented about half of the 21 anticipated 
CSI ports outlined in the CSI budget for fiscal year 2003. Deployments are 
sometimes delayed, according to Customs officials, for reasons such as the 
logistics of placing Customs staff overseas and the readiness of the foreign 
ports. (See table 5 for list of CSI arrangements and deployments.) 




Table 5: Dates of CSI Bilateral Arrangements and Deployments by Targeted Ports, May 2003 


Country 


Port 


Date arrangement 
signed 


CSI team deployments 
in first year 


CSI team deployments 
after first year 


Smart border accord 


Canada 


Halifax 


December 2001 


March 2002 






Montreal 


December 2001 


March 2002 






Vancouver 


December 2001 


March 2002 




Top 20 ports 


Belgium 


Antwerp 


June 2002 




February 2003 


China 


Shanghai 


October 2002 a 








Yantian 


October 2002 a 






France 


Le Havre 


June 2002 


December 2002 




Germany 


Bremerhaven 


August 2002 




February 2003 




Hamburg 


August 2002 




February 2003 


Hong Kong 


Hong Kong 


September 2002 




May 2003 


Italy 


Genoa 


November 2002 








La Spezia 


November 2002 






Japan 


Tokyo 


September 2002 








Nagoya 


September 2002 








Kobe 


September 2002 








Yokohama 


September 2002 




March 2003 


The Netherlands 


Rotterdam 


June 2002 


August 2002 




Singapore 


Singapore 


September 2002 




March 2003 


South Korea 


Pusan 


January 2003 






Spain 


Algeciras 


January 2003 






Taiwan 


Kaohsiung 








Thailand 


Laem Chabang 








United Kingdom 


Felixstowe 


December 2002 
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(Continued From Previous Page) 


Country Port 


Date arrangement 
signed 


CSI team deployments 
in first year 


CSI team deployments 
after first year 


CSI strategic ports 


Malaysia Klang 


January 2003 






Tanjung Pelepas 


January 2003 






Sweden Gothenburg 


January 2003 




May 2003 



Source: GAO analysis of Customs data. 



a China has "agreed in principle" to join CSI but has not signed a CSI bilateral arrangement. 

According to Customs, between the time of the initial deployments for the 
first five CSI ports and May 2003, the CSI teams screened manifest data for 
more than 606,000 containers, looking for high-risk cargo. Their screening 
efforts identified a total of 2,091 containers they considered to be high risk 
that were then inspected by host customs administrations. Officials from 
the three foreign customs administrations we visited told us that, so far, the 
CSI requests for inspection had not been a burden, and that they had often 
invited the CSI teams to observe inspections. At the three CSI ports in 
Canada, around 343,000 containers were screened, and 2,022 containers 
were inspected between the time of the CSI deployments in March 2002 
and May 2003. At the port of Rotterdam, the CSI team screened more than 
203,000 containers, and Dutch customs inspected 54 containers between 
September 2002 and May 2003. At the port of Le Havre, the CSI team 
screened more than 59,000 containers, and French customs inspected 15 
containers between December 2002 and May 2003. A Customs official 
informed us that these inspections did not reveal any WMDs. 

Program Operations Evolved as As the first CSI team arrived in Rotterdam, Customs encountered data 
CSI Team in First Port Faced limitations that required revising its approach to obtaining needed 

Challenges information for screening containers. CSI operations overseas involve the 

utilization of complete, accurate, and timely manifest data to target high- 
risk containers bound for the United States. However, the manifest 
information in Customs' Automated Targeting System was insufficient, 
because carriers did not always submit manifest data to U.S. Customs 
electronically, completely, and prior to the containers' departure from 
foreign ports to the United States. Therefore, Customs planned to 
supplement its own manifest database with manifest data provided by 
foreign customs administrations at CSI ports. 

Soon after deploying CSI teams at the first European CSI port of 
Rotterdam, Customs realized that its ability to effectively screen containers 
was limited by the host customs administration's lack of sufficient export 
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manifest data for container traffic leaving Rotterdam and headed for U.S. 
seaports. According to U.S. Customs officials, like most customs 
administrations, Dutch customs does not completely track export data. 
Although the CSI team was provided manifest data on U.S.-bound 
containers by the host customs, this information generally was limited to 
containers transferred from one vessel to another at Rotterdam, and even 
then, the data sometimes arrived after the vessel's departure. In addition, 
the CSI team did not have information for containers remaining on board a 
vessel that was destined for the United States but that stopped at the port 
of Rotterdam. Furthermore, the CSI team did not have manifest data for 
containers leaving Rotterdam after arriving via truck, train, or barge from 
other countries. 

Customs also learned soon after the CSI team's arrival in Rotterdam that 
the physical layout of the port and the sovereign laws of the Netherlands 
posed other challenges to the CSI team's receipt of needed manifest 
information. For example, the CSI team discovered that in the port of 
Rotterdam there were 40 different physical locations where Dutch Customs 
received paper manifests. In addition, the CSI team learned that under 
Dutch law, paper manifests could not be removed from certain locations. 
Given the logistical challenges of compiling information from the 40 
locations, as well the limitations posed by existing Dutch law, the two 
customs administrations realized that providing the CSI team with this 
information would not be feasible. Customs officials told us that without 
complete and accessible manifest data, the CSI team could not achieve its 
goal of screening containers at foreign ports. 

On the basis of its experiences in Rotterdam, Customs took steps to modify 
its approach. First, Customs expedited the development and finalization of 
its 24-Hour Rule, which established new requirements that carriers present 
complete vessel cargo declarations to Customs 24 hours before loading 
cargo aboard a vessel at foreign ports, regardless of whether these ports 
are CSI or non-CSI ports, for transport to the United States. 22 This 



22 The 24-Hour Rule is Customs' rule on the "Presentation of Vessel Cargo Declaration to 
Customs Before Cargo Is Laden Aboard Vessel at Foreign Port for Transport to the United 
States," implemented in December 2002. For example, according to Customs officials, for a 
U.S.-bound container initially loaded onto a vessel in St. Petersburg, Russia that then stops 
at the port of Rotterdam before arriving at a U.S. port, the carrier must submit a manifest to 
U.S. Customs 24 hours before the container is loaded onto the vessel in St. Petersburg. For 
a container that is transported to the port of Rotterdam by train then loaded onto a vessel to 
be shipped to the United States, the carrier must submit a manifest 24 hours before the 
container is loaded onto a vessel in Rotterdam. 
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amendment allowed Customs to overcome the obstacle of obtaining 
manifest data on containerized exports bound for the United States at 
foreign ports — a critical element in the process of screening containers 
overseas. Instead, the CSI teams would now have direct access to the 
needed manifest data, thus lessening their dependence on foreign customs 
to provide it. 

Customs also modified the composition and procedures of CSI assessment 
teams in order to gather all information needed for a full understanding of 
port operations prior to the CSI team's arrival. Customs officials stated 
that the insufficiency of information collected by the assessment teams at 
Rotterdam delayed Customs' discovery that the port's manifest data for 
U.S.-bound containers was incomplete. The inadequacy of the information 
collected by the team resulted, in large part, from the team's lack of subject 
matter expertise and a tool to standardize the collection of relevant 
information at CSI ports. Customs officials told us that they have since 
identified the required skills and have incorporated staff with significant 
expertise from various offices within Customs to properly survey foreign 
ports. In addition, Customs developed a standardized survey questionnaire 
to obtain information about a host nation's port, such as the physical 
infrastructure and the availability of manifest and cargo information. 
Furthermore, Customs now collects the same information from foreign 
customs administrations in advance in an effort to inform the assessment 
teams prior to their visits. 



Many Companies Enrolled 
in C-TPAT, Program 
Evolving Over Time 



Customs quickly designed C-TPAT and rolled-out some key program 
elements, adjusting its implementation over time. Since the beginning of 
the program, Customs enrolled a large number of companies across the 
United States, receiving security profiles from half of those companies and 
providing feedback letters to half of the companies that submitted security 
profiles. More recently, Customs began pretesting another program 
element, validations, with a few companies. Initially, Customs expected 
that its account managers, who had experience working with the trade 
community, could promote the program and help companies develop 
action plans. However, Customs soon realized that it needed staff with a 
different skill set, supply chain security expertise, to help with future 
program elements, including validations and action plans. In response, 
Customs created a new supply chain specialist position, which was 
finalized in May 2003. Customs will continue to modify the program as it 
becomes aware of needed changes and implements other key program 
elements. 
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Numerous Companies Enrolled In December 2001, the first charter members, seven importers, signed 
in C-TPAT Program agreements and enrolled in C-TPAT. 23 Beginning in February 2002, C-TPAT 

invited importers that were already participating in Customs' Low-Risk 
Importer Initiative to join C-TPAT. 24 Open enrollment for all other importers 
began in April 2002, and enrollment for other trade sectors opened 
thereafter. Customs' outreach targeted large to medium-sized companies in 
order to immediately cover a large percentage of the trade entering the 
United States. C-TPAT, in consultation with private-sector partners, plans 
to expand the program to foreign warehouse operators and manufacturers. 
Figure 4 depicts C-TPAT enrollment time line by type of industry. 



Figure 4: Time line of C-TPAT Enrollment Opportunities 
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According to C-TPAT officials, in January 2003, approximately 1,700 
companies had signed C-TPAT agreements, becoming C-TPAT members 
and receiving the benefit of a partially reduced risk score. During the first 
year of the program, more than 800 of these companies had completed the 
next step in the program and submitted security profiles to Customs. 
Customs sent feedback letters to 429 companies, granting 416 of them full 



23 The seven charter members included British Petroleum, DaimlerChrysler, Ford Motor 
Company, General Motors Corporation, Motorola, Sarah Lee Corporation, and Target 
Corporation. 

24 The Low-Risk Importer Initiative is a trade compliance program designed to significantly 
reduce Customs examinations for high compliant importers. The low-risk designation 
means that Customs has conducted a review of the importer's compliance assessments, 
targeted cargo exams and document reviews, account manager evaluations, compliance 
measurement, enforcement results, and financial health. 
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program benefits, including a further reduction in their company risk 
scores. The remaining 13 companies received feedback letters from 
Customs informing them that their profiles were insufficient for the 
companies to be granted full benefits. Table 6 provides information on the 
status of the C-TPAT program membership by type of industry sector and 
status of key program elements. 

By May 2003, the number of agreements signed nearly doubled to 3,355. 
According to C-TPAT officials, the 10 program staff were able to review all 
1,837 security profiles and prepare all 1,105 feedback letters in a timely 
manner. Customs officials told us that they had not removed any 
companies from C-TPAT membership due to the determination that a 
member company's commitment is not serious or that a member company 
had intentionally misled Customs or for other matters. As of the end of 
May 2003, Customs had not fully implemented other critical program 
elements, such as validations, company action plans, and annual 
assessments, designed to ensure that companies have taken action to 
improve and maintain supply chain security practices. A few validations 
had been completed, as the concept was being pretested. No action plans 
or annual assessments had been prepared. 



Table 6: Status of C-TPAT Membership by Industry Sector and Key Program Elements, January 2003 and May 2003 



Brokers, freight 
forwarders, 
nonvessel 
operating 



Domestic port 
authorities and 
terminal 



Key program 
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Importers 


Carriers 




common carriers 


operators 




Total 




Jan. 


May 


Jan. 


May 


Jan. 


May 


Jan. 


May 


Jan. 


May 


Agreements signed 


1,106 


2,119 


134 


410 


466 


806 





20 


1,706 


3,355 


Security profiles 
submitted to Customs 


517 


1,088 


88 


242 


254 


499 





8 


859 


1,837 


Feedback letters sent 
by Customs 


306 


623 


37 


163 


86 


312 





7 


429 


1,105 


Validations (pretested) 





15 























15 


Action plans 
































Annual assessments 

































Source: Customs. 
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C-TPAT Program Operations Are Customs has adjusted elements of C-TPAT operations since the program's 
Evolving Over Time inception and plans to continue doing so as it gains experience and begins 

implementing other program elements. Initially, Customs expected to use 
account managers to recruit companies and field general questions about 
the application process. Customs also expected that account managers 
would help companies develop action plans in response to Customs 
assessments of supply chain security practices. However, C-TPAT officials 
later realized that account managers lacked the skill set necessary to 
provide more than basic program information to companies. In response, 
Customs took action to hire supply chain specialists to provide the 
requisite skill set needed to implement various C-TPAT program elements 
and limited the role of account managers to promoting the program. 
Account managers were instructed to refer any technical inquiries from 
applicants about completing their security profiles to the four C-TPAT 
program managers. 

In October 2002, Customs began the process of developing a new position 
description for supply chain specialists and obtaining authorization to hire 
more than 150 such specialists. In May 2003, the specialist position was 
announced. C-TPAT officials plan to hire 40 specialists by the end of fiscal 
year 2003. According to C-TPAT officials and program documents, 
specialists will be used to guide companies in the development of their 
security profiles, conduct validations, develop action plans, and facilitate 
annual assessments. However, given the need to complete over 3,000 
validations and establish accountability, the C-TPAT officials most recently 
told us that the specialists would focus on conducting validations and 
action plans. 

Early implementation of the program focused on recruiting companies and 
collecting information on companies' security practices. So far, companies 
have only had to report on their existing and planned security practices. As 
the program evolves, validation and action plans will be used by Customs 
to advise C-TPAT members to adopt new security measures that could 
impose increased costs if adopted. According to C-TPAT officials, supply 
chain specialists will play a critical role in implementing the next C-TPAT 
program elements while balancing the dual goals of improving security 
with facilitating trade. The supply chain specialists, according to C-TPAT 
officials, will increase the program's creditability by bringing on experts 
who can make feasible and meaningful recommendations that will compel 
companies to change their security practices. C-TPAT officials told us the 
program will continue to evolve as the other program elements such as the 
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company action plans and annual assessments are developed and 
implemented and lessons are learned. 



Although CSI and C-TPAT are evolving into major tools in the U.S. war 
against terrorism, in implementing the programs, Customs has not taken 
adequate steps to incorporate human capital planning, develop 
performance measures, and plan strategically — factors essential to the 
programs' long-term success and accountability. 25 While Customs was able 
to meet the programs' initial staffing needs, it has not devised a systematic 
plan to recruit, train, and retain the expected fivefold increase in CSI 
overseas staff by fiscal year 2004. In addition, Customs lacks a plan for 
increasing the number of C-TPAT staff almost 15-fold, from 10 to more than 
160, while it rolls out new program elements. Although Customs had 
created some performance measures, such as tallying the number of 
countries and companies that have enrolled in the CSI and C-TPAT, 
respectively, it has not developed measures that establish accountability 
and measure program achievements. For example, Customs lacks 
measures that assess the impact of CSI and C-TPAT on improving targeting 
and security practices, respectively — the programs' fundamental goals. In 
its effort to rapidly implement the programs and enroll participants, 
Customs focused on short-term operational planning. As a result, Customs 
lacks the elements of strategic planning that would allow it to establish 
program accountability for approximately $73 million in funds budgeted for 
fiscal year 2004. 



CSI and C-TPAT at Critical Customs has come to a critical point in its management of CSI and C-TPAT, 
Point as ^ ne y transition from start-up programs to mature global programs on the 

front lines of the U.S. effort to address container security and protect 



25 In a report on the formation of DHS, we identified from our body of work the major 
success factors that DHS officials will need to consider to successfully manage the new 
department. Drawing on that list, we identified three factors critical to the management of 
CSI and C-TPAT. Human capital planning includes thinking strategically about how to put 
people with the right set of skills, in the right jobs at the right time. Performance measures 
help demonstrate an organization's level of progress in achieving results and inform 
decision making. Strategic planning includes involvement of stakeholders; assessment of 
environments; and the alignment of activities, core processes, and resources to support 
mission objectives. See U.S. General Accounting Office, Major Management Challenges and 
Program Risks: Department of Homeland Security, GAO-03-102 (Washington, D.C.: 
January 2003). 



Customs Has Not 
Adequately 
Incorporated Factors 
Critical to Programs' 
Success and 
Accountability 
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global commerce. Whereas Customs quickly launched the programs in 
response to homeland security concerns, the programs have now reached 
the stage where Customs projects a rapid expansion to additional countries 
and companies, as well as additional C-TPAT program elements, such as 
validations. Furthermore, Customs has proposed to commit significantly 
more resources to both of these programs. (See fig. 5.) For example, the 
CSI budget will increase from $4.3 million in the first year to more than $61 
million proposed for fiscal year 2004, and C-TPAT staff levels will jump 
from approximately 10 to more than 160 by the end of fiscal year 2004. 



Figure 5: Budgets and Anticipated Growth for CSI Ports and C-TPAT Staff, Fiscal 
Years 2002 and 2004 
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Customs Has Not Created 
Human Capital Plans for CSI 
and C-TPAT 



Over 1 year into the implementation of CSI and C-TPAT, Customs has not 
developed a human capital plan that systematically addresses long-term 
staffing needs such as recruiting, training, and retaining personnel for these 
programs. A key element of human capital planning includes thinking 
strategically about how to put the right people in the right jobs at the right 
time. By the end of fiscal year 2004, Customs will need to attract at least 
120 CSI employees with the skills to identify high-risk containers at 30 
ports and who are willing to live in challenging environments. Ultimately, 
Customs envisions maintaining CSI teams at 43 or more ports. C-TPAT 
intends to hire and train more than 150 supply chain specialists within the 
next few years to review company security profiles for weaknesses, 
identify solutions, and maintain company relations to ensure that voluntary 
improvements are made. While short-term human capital decision making 
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was necessary in the programs' first year to address the challenge of a rapid 
start-up, Customs is now required, as a result of its transfer to DHS, to face 
these and other important human capital questions to ensure CSFs and C- 
TPAT's long-term success. 26 

Deploying Customs staff to overseas CSI ports will be a complex, multiyear 
task. Customs seeks CSI candidates with targeting, diplomatic, and 
language skills. Customs officials stated that they did not experience 
significant difficulties in finding qualified staff to fill its short-term human 
capital needs from among the pool of existing Customs employees, such as 
inspectors from the Office of Field Operations. However, Customs 
anticipates creating 2- to 3-year permanent assignments to replace its 
current 120-day temporary duty assignments, which could strain existing 
resources. In spite of the potential challenges Customs could face, CSI 
officials said that they had not documented a human capital plan and would 
instead, in the near term, rely exclusively upon other Customs offices such 
as the Office of Field Operations to use their own standards to screen and 
make final selections of CSI staff for placement at CSI ports overseas. 

Customs faces a daunting task as it prepares for its future human capital 
needs at key CSI ports overseas, including strategic ports in countries 
where it may be difficult to attract U.S. personnel. Specifically, Customs' 
port status planning document projects the deployments of CSI teams in 
fiscal year 2004 to seven countries (Brazil, China, Greece, Sri Lanka, 
Thailand, Turkey and the United Arab Emirates) for which the Department 
of State requires pay compensation to U.S. government officials for 
hardships they may encounter while working in these locations. 27 As an 
example of how challenging it can be to place staff overseas, we found that 
the Department of State, whose staff routinely serves overseas, had 
difficulty filling positions in hardship posts and that, as a consequence, the 
affected embassies were hampered in their ability to effectively carry out 
U.S. foreign policy objectives. The difficulties faced by the Department of 
State demonstrate that staffing posts abroad with appropriately skilled 



26 P.L. 107-296, Nov. 25, 2002, established the new department. The legislation requires all 
agencies moving into DHS, such as Customs, to appoint chief human capital officers and 
include human capital planning in performance plans and performance reports. See U.S. 
General Accounting Office, Homeland Security: Management Challenges Facing Federal 
Leadership, GAO-03-260 (Washington, D.C.: Dec. 20, 2002). 

27 As of May 2003, Customs had not reached agreements with six of these countries, but had 
reached "agreement in principle" with China. 
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personnel is a challenge even for agencies with a long history of recruiting 
and placing staff overseas. Without a human capital plan that includes 
recruiting and training strategies, Customs may be unable to identify and 
develop the human resources necessary to handle the staffing for the 
expanded number of CSI ports. 

As with CSI, Customs plans to expand C-TPAT by hiring over 150 additional 
staff that will help implement new program elements such as validations 
and actions plans. The duties of these new staff, or supply chain 
specialists, are to identify, recommend, and negotiate with member 
companies to undertake corrective actions to improve supply chain 
security, as well as to guide companies through the C-TPAT process. 
Customs officials said that they expect to hire 40 supply chain specialists in 
fiscal year 2003 and the remaining number after that. However, although 
Customs acknowledged the importance of human capital planning for C- 
TPAT, Customs officials indicated that they have been unable to devote 
resources to developing a human capital plan that outlines how C-TPAT 
will increase its staff 15-fold and implement new program elements that 
will require training. 

A human capital plan that emphasizes recruitment, retention, and training 
is particularly important given the unique operating environments and 
personnel requirements of the two programs. According to Customs 
officials, the professional and personal relationships that CSI team 
members and C-TPAT supply chain specialists build with their clients over 
time will be critical to the long-term success of both programs. For 
example, Customs has indicated that a key benefit of CSI is the ability of 
Customs officials to work with their foreign counterparts to obtain 
sensitive information that enhances its targeting of high-risk containers at 
the foreign ports. If Customs fails to establish these good working 
relationships, the added value of targeting from foreign ports is called into 
question. Similarly, Customs officials indicated that C-TPAT's success at 
improving supply chain security will depend, in large part, on supply chain 
specialists' ability to persuade companies to voluntarily adopt C-TPAT 
recommendations. Given the reliance of CSI and C-TPAT staff on 
relationships and persuasion rather than authority, a human capital plan 
that regularly places personnel with language skills and the ability to work 
effectively in these environments will maximize the programs' 
performance. In the absence of a human capital plan, Customs may be 
unable to anticipate potential obstacles to placing the right people in the 
right jobs at the right time. 



Page 29 



GAO-03-770 Container Security 



Customs Developed Limited Customs has attempted to create some performance measures for CSI and 
Performance Measures C-TPAT, but neither program has developed measures that reflect progress 

in achieving program goals. Organizations use performance measures to 
help demonstrate the level of progress in achieving results, to inform 
decision making, and to hold managers accountable. To better articulate a 
results-orientation, organizations create a set of performance goals and 
measures that addresses important dimensions of program performance. 
Using intermediate goals and measures, such as outputs or intermediate 
outcomes, would allow Customs to measure progress toward enhancing 
the security of U.S.-bound ocean container trade, the primary goal of these 
programs. 28 As other programs are proposed to address homeland security 
needs, DHS and the Congress must have access to credible performance 
information that allows them to make resource allocation decisions across 
programs and hold managers accountable. 

Customs officials had developed some measures for CSI and C-TPAT that 
simply quantify program results like operational activities and efforts. For 
example, Customs tracks the number of CSI teams operating in foreign 
ports and the number of countries that have signed up to participate in CSI, 
as well as the number of CSI inspections. Similarly, for C-TPAT, Customs 
tracks results like the number of companies from different industrial 
sectors that participate in the program and the percentage value of cargo 
imported by C-TPAT companies. These measures have served as useful 
indicators of operational results. 

However, Customs had not developed measures to help assess how CSI's 
presence overseas helps improve targeting of high-risk containers beyond 
Customs' existing capabilities. As previously discussed, Customs officials 
stated that the most important benefit derives from the collocation of U.S. 
and foreign customs officials, which provides them with additional 
information that should enhance Customs' targeting abilities. However, 
Customs does not analyze statistics to ascertain the nature and extent of 
the contributions made by foreign customs administrations in determining 
whether a particular container should be targeted or inspected. Customs 
officials told us that they had not had the opportunity to prepare 
performance measures that will help evaluate CSI's outcomes. In the 



28 U.S. General Accounting Office, Agency Performance Plans: Examples of Practices That 
Can Improve Usefulness to Decisionmakers, GAO/GGD/AIMD-99-69 (Washington, D.C.: 
Feb. 26, 1999). 
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absence of performance indicators that provide a measure of the program's 
success, the benefits of placing personnel overseas are unclear. 

On the other hand, Customs developed a performance measure to indicate 
whether C-TPAT has resulted in improved security practices, using the 
results of trade compliance audits as a proxy. This indicator uses select 
data elements derived from trade compliance audits, such as whether the 
container seals indicated possible tampering and whether the manifest 
contained data discrepancies (e.g., whether cargo weight significantly 
changed between export and arrival). While this is a useful first step, its 
effectiveness is limited by the fact that it compares two different 
populations, contrasting the behavior of C-TPAT members with that of non- 
C-TPAT members. A more reliable measure of program impact would 
compare companies' trade compliance before and after they enroll in C- 
TPAT As of May 2003, Customs had not developed any other indicators to 
ascertain whether C-TPAT has had an impact on the members' supply chain 
security practices. Recent efforts to validate the C-TPAT security profiles 
provide Customs with an opportunity to establish baseline data to later 
determine whether members' security practices improve over time. The 
validations also provide Customs an opportunity to authenticate the 
information contained in security profiles and determine whether the 
company merits a continued reduction in its risk score. 



Customs Planning Efforts 
Do Not Reflect Strategic 
Approach 



Customs does not have a strategic plan that describes how it intends to 
achieve CSI and C-TPAT goals and objectives and that makes full 
accountability possible. According to Customs, the short-term 
requirements of implementing the programs quickly and encouraging 
program participation by countries and companies impeded Customs' 
ability to systematically carry out strategic planning. Strategic planning 
helps organizations manage their programs more effectively by requiring 
that they clearly establish mission goals and objectives and, after assessing 
their environment and involving stakeholders, describe how program 
activities serve program goals. In addition, strategic plans can provide a 
basis for communication and mutual understanding between stakeholders 
and contribute to program accountability. 



Although Customs has taken some steps that demonstrate operational 
planning for CSI implementation in key ports throughout the world, its 
efforts do not reflect a strategic approach to planning. While Customs 
intends to continue deploying CSI teams to the 20 top ports and to 20 to 25 
strategic ports, it has not prepared strategic plans that show how it will 
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accomplish this enormous task. Whereas Customs told us that it intends to 
develop strategic plans, so far, the only available record regarding its 
expansion plans is a table outlining when Customs expects to deploy CSI 
teams to foreign ports for fiscal years 2003 and 2004. 

Without the benefit of strategic planning, Customs quickly rolled out CSI in 
France but failed to involve primary stakeholders in making key decisions. 
Although Customs officials pointed to their collaboration with the French 
government as a model of cooperation in setting up this port, a lack of 
communication between the partner countries caused French customs 
officials to impose unnecessary demands on private industry shipping out 
of Le Havre to provide the CSI team with complete manifest information 
needed for effective targeting. Customs had failed to inform the French 
that it was implementing the 24-Hour Rule, which essentially negated the 
need for the French effort. When we met with French government officials, 
they expressed frustration that they had not been kept informed. Poor 
communication, as evidenced by this experience, can lead to a lack of 
cooperation between the two partners and make attainment of CSI goals 
more difficult. Good communication is essential for a program like CSI, 
which relies on the exchange of information between the U.S. and foreign 
customs administrations to improve the targeting of high-risk containers. 

Customs' experience in rolling out C-TPAT similarly demonstrates a lack of 
strategic planning. This is particularly true with regard to Custom's 
communicating how it plans to implement critical C-TPAT program 
elements — validations, action plans, and annual assessments — designed to 
verify that companies have security measures in place and follow through 
with recommended changes. Customs does not have a planning document 
that describes the operational objectives for each element, how those 
objectives support C-TPAT's overall goals, and how they intend to meet 
those objectives. Although Customs recently pilot-tested the validation 
process with 15 companies, they have yet to incorporate results and 
lessons learned into a planning document to guide the validation process 
for the more than 3,300 companies currently receiving C-TPAT's key benefit 
of reduced risk scores. 

Customs lacks a strategic plan that describes how Customs intends to 
achieve its programs' goals and establish program accountability for 
approximately $73 million in funds budgeted for fiscal year 2004. 
Furthermore, Customs does not have strategic planning documents that 
establish measurable objectives, detailed implementation strategies, 
resource needs, and project time frames for CSI and C-TPAT. The effective 
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implementation of CSI and C-TPAT programs depends, in part, on rigorous 
strategic planning. Without strategic plans, Customs may discover that CSI 
cannot place CSI teams in strategic ports in a timely fashion, or that they 
place the teams but do not achieve any improvement in security. Similarly, 
Customs may find that the security of C-TPAT companies' supply chains is 
not improved and that, as a result, reductions in risk scores are granted to 
undeserving companies. 



Conclusions Customs quickly launched CSI and C-TPAT to secure ocean containers 

bound for U.S. seaports. However, accomplishing the desired outcome of 
securing containers bound for the United States and achieving the long- 
term effectiveness of both programs would be aided by human capital 
planning, the development of performance measures, and strategic 
planning, elements that Customs has not fully incorporated into the 
programs. As CSI and C-TPAT make the transition from early 
implementation to full-scale operations, Customs' management of these 
programs has not evolved from its short-term focus to a long-term strategic 
approach. Customs faces unprecedented demands as it expands CSI to 
other countries and C-TPAT begins rolling out the critical validation phase 
of the program. Planning and measuring program performance to 
determine if goals and objectives are being met play an important role in 
the management of Customs operations and enable internal and external 
decision makers to assess the programs' effectiveness, make resource 
allocation decisions, and hold managers accountable. 



To help ensure that CSI and C-TPAT achieve their objectives as they 
transition from smaller start-up programs to larger programs with an 
increasingly larger share of the Department of Homeland Security's budget, 
we recommend that the Secretary of Homeland Security, working with the 
Commissioner of Customs and Border Protection and the CSI and C-TPAT 
program directors, takes the following steps: 

Develops human capital plans that clearly describe how CSI and C-TPAT 
will recruit, train, and retain staff to meet their growing demands as they 
expand to other countries and implement new program elements. These 
plans should include up-to-date information on CSI and C-TPAT staffing 
and training requirements and should be regularly used by managers to 
identify areas for further human capital planning, including opportunities 
for improving program results. 



Recommendations for 
Executive Action 
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Expands efforts already initiated to develop performance measures for CSI 
and C-TPAT that include outcome-oriented indicators. These measures 
should be tangible, measurable conditions that cover key aspects of 
performance and should enable agencies to assess accomplishments, make 
decisions, realign processes, and assign accountability. Furthermore, the 
measures should be used to determine the future direction of these 
Customs programs. 

Develops strategic plans that clearly lay out CSI and C-TPAT goals, 
objectives, and detailed implementation strategies. These plans should not 
only address how the strategies and related resources, both financial and 
human, will enable Customs to secure ocean containers bound for the 
United States, but should also reinforce the connections between these 
programs' objectives and both Customs' and the Department of Homeland 
Security's long-term goals. 



Agency Comments and 
Our Evaluation 



Customs provided written comments on a draft of our report. Customs 
agreed with our recommendations and overall observations that it needs to 
take adequate steps to incorporate human capital planning, expand efforts 
to develop performance measures and develop strategic plans — factors 
necessary for the long-term success and accountability of CSI and C-TPAT. 
Customs reported that is has already taken some steps and will continue to 
take prudent steps to address these factors. Customs, however, raised 
concerns about the draft report's characterization of some information. 
Customs also provided technical comments, which we incorporated as 
appropriate. The following summarizes their general comments and our 
responses. Customs' comments, along with our responses to specific 
points, are contained in appendix II. 

We made changes to our report to address Customs' concerns that we 
overlooked CSI's central tenet — U.S. Customs inspectors must be able to 
observe the inspections conducted by host customs officials — which, 
according to Customs, is accepted by all partner Customs administrations. 
We revised the report to note CSI's central tenet and its acceptance by all 
partners, but we also noted that the bilateral arrangements do not specify 
that U.S. inspectors must be able to observe inspections conducted by host 
customs officials. Although Customs requested, we did not drop our 
statement that CSI teams are often invited to attend inspections because 
this is what officials from three foreign customs administrations told us. 
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Customs raised concerns about our characterization of the expected role of 
account managers in C-TPAT. In its general comments, Customs noted that 
account managers were never expected to help companies develop action 
plans. This statement directly contradicts previous statements by Customs 
officials as well as an early program document. Therefore, we maintain 
that Customs account managers were initially expected to help companies 
develop action plans. 

Customs noted that its policy is not to reject companies because of an 
inadequate security profile or for adverse information discovered during 
the review process. However, Customs provided further clarification that it 
may, under certain circumstances, withhold or reduce C-TPAT benefits. 
Furthermore, Customs stated that it may remove a company from C-TPAT 
membership if it determines that its commitment is not serious or that it 
has intentionally misled Customs. We incorporated changes in our report 
to reflect these clarifications. 



We are sending copies of this report to other interested members of 
Congress, the Secretary of the Department of Homeland Security, and the 
Commissioner of Customs. We also will make copies available to others 
upon request. In addition, the report will be available at no charge on the 
GAO Web site at http://www.gao.gov. 

If you or your staff have any questions about this report, please contact me 
on (202) 512- 4347. Other GAO contacts and staff acknowledgments are 
listed in appendix III. 




Loren Yager 

Director, International Affairs and Trade 
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Appendix I 



Scope and Methodology 



To describe the Container Security Initiative (CSI) and the Customs-Trade 
Partnership Against Terrorism (C-TPAT), we met with U.S. Customs 
officials in Washington, D.C. with program responsibilities for CSI and C- 
TPAT Specifically, we met with officials in the Office of International 
Affairs to discuss the planning and start-up of the CSI program. In 
examining the CSI program, we limited the scope of our work to two of the 
CSI program's four elements — (1) identifying "high-risk" containers and (2) 
screening the "high-risk" containers at the foreign CSI ports before they are 
shipped to U.S. ports. Our examination of those two elements focused on 
the planning and management issues specific to the rollout of this program 
abroad in the program's first year. We did not examine the adequacy of 
Customs-wide tools and technology, such as the Automated Targeting 
System, for successfully targeting high-risk ocean containers. We reviewed 
documents on CSI including testimony and speeches by Customs officials, 
as well as information on the Customs Web site, which outlined CSI goals, 
implementation strategies, and operations plans. In addition, we reviewed 
Customs documentation, to understand CSI procedures including 
agreements with the foreign countries to set up CSI at designated ports, 
CSI assessment teams' survey questionnaire at ports, and CSI budget and 
staffing data. We visited the ports of New York-New Jersey, Los Angeles, 
and Long Beach to familiarize ourselves with Customs' standard operating 
procedures in a seaport environment. At the ports, we interviewed 
Customs officials and observed operations, with particular emphasis on 
Customs cargo container targeting units charged with using the Automated 
Targeting System to screen cargo containers entering U.S. ports. 

We also met with C-TPAT officials from the Office of Field Operations to 
discuss program goals, implementation strategies, and plans. We reviewed 
C-TPAT program documents outlining the early planning efforts for the 
program. We also met with private companies and industry associations in 
the United States to obtain their views on C-TPAT, supply chain 
vulnerabilities and corroborate information provided by Customs. We 
attended conferences in Phoenix and Chicago that included remarks by 
Customs officials and private sector representatives on the start-up of C- 
TPAT, including the process for application for membership. We met with 
officials from both the Office of Naval Intelligence and the National 
Defense University to understand threats and vulnerabilities associated 
with the overseas container supply chain. 

To examine Customs' implementation of CSI and C-TPAT during the first 
year, we interviewed Customs officials at the Washington, D.C, 
headquarters as discussed earlier. For CSI, we reviewed Customs press 
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Scope and Methodology 



releases to learn the status of CSI bilateral arrangements with various 
countries and the deployment of CSI staff at foreign ports. We also 
reviewed and analyzed Customs documentation, including arrangements 
with the foreign countries to set up CSI at designated ports, trip reports to 
prospective CSI ports, port assessments, plans for CSI operations at the 
port of Rotterdam, and statistics on the number of containers screened by 
CSI teams and the number of containers inspected by local customs at CSI 
ports to date. For the C-TPAT program, in Washington, D.C., we reviewed 
and analyzed C-TPAT paperwork for selected member companies, 
including partnership agreements, company profiles of their supply chains, 
and security measures taken to secure their supply chains, as well as C- 
TPAT's feedback letters welcoming companies as certified members and 
recommending improvements to their supply chains. We discussed with 
representatives of U.S. companies their experiences in becoming members 
of C-TPAT and their efforts to improve the security of their supply chains, 
particularly those parts of the supply chain controlled by their foreign 
suppliers. 

As part of our examination of the first year of implementation of CSI and C- 
TPAT, we also visited four countries — Canada, the Netherlands, France, 
and Germany. In Canada, the Netherlands, and France, we met with U.S. 
Embassy officials, particularly the U.S. Customs attaches responsible for 
managing CSI implementation in the ports of Vancouver, Rotterdam, and Le 
Havre. We discussed the issues that came up during the CSI negotiations 
and the substance of the final arrangements between the U.S. and host 
governments. We also discussed the start-up of the CSI program, as well as 
any issues that had arisen during implementation in each country. We 
interviewed CSI team members at each port to obtain detailed explanations 
of CSI operations there and any available related documentation. At the 
ports of Vancouver and Le Havre, we were able to observe customs 
operations and the interaction of the CSI team with its host country 
officials. We were not able to observe CSI operations at the port of 
Rotterdam, owing to a decision by the Dutch government to restrict the 
number of foreign delegations that could access customs operations at 
Rotterdam. However, in the Netherlands, as well as in France and Canada, 
we were able to interview foreign government officials about the 
negotiations to start up CSI in their ports, issues and problems related to 
the start-up of the program, and their views regarding the future of the CSI 
program in their ports. For the C-TPAT program, we interviewed trade 
associations, port authorities, suppliers, and supply chain service providers 
during our visits to Canada, Germany, France, and the Netherlands. With 
trade associations, we discussed their impressions of C-TPAT, and the 
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potential impact that C-TPAT security expectations could have on 
members' operations. With port authorities, suppliers, and supply chain 
service providers, we observed their operations and discussed the potential 
impact that implementing C-TPAT security recommendations could have 
on their operations and the vulnerabilities that they faced. 

To assess the extent to which Customs has focused on factors critical to 
the long-term success of the programs, we first reviewed a broad range of 
GAO reports examining management factors that were necessary 
components for the successful management of cabinet departments, 
agencies, and, by extension, individual programs. As the result of our 
review of GAO's work on best management practices, we chose to focus 
this analysis on three management factors — human capital planning, the 
development of performance measures, and strategic planning — because 
of their general importance in the literature. (In particular, a recent GAO 
report identified critical factors, including the three listed above, that the 
new Department of Homeland Security would need to incorporate for the 
successful long-term management of the new department. 1 ) In addition to 
interviewing Customs officials in Washington, as described above, we 
examined available budgetary and other documentation to ascertain 
management plans for the expansion of CSI and C-TPAT. We assessed the 
extent to which Customs expansion plans incorporated human capital 
planning, the development of performance measures, and strategic 
planning. 

We performed our work from April 2002 to June 2003 in accordance with 
generally accepted government auditing standards. 



Mj.S. General Accounting Office, Major Management Challenges and Program Risks: 
Department of Homeland Security, GAO-03-102 (Washington, D.C.: January 2003). 
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Appendix II 



Comments from the Bureau of Customs and 
Border Protection 



Note: GAO comments 
supplementing those in 
the report text appear 
at the end of this 



appendix. 



U.S. CUSTOMS AND BORDER PROTECTION 
Department of Homeland Security 



1300 Pennsylvania Avenue, N.W., Washington, D.C. 20229 



Commissioner of Customs 



July 16, 2003 

Mr. Loren Yager 

Director, International Affairs and Trade 
General Accounting Office 
441 G Street, N.W. 
Washington, D.C. 20548 

Dear Mr. Yager: 

On behalf of the Secretary of Homeland Security, I would like to thank you for 
providing us with a copy of your draft report entitled "Container Security: 
Expansion of Key Customs Programs Will Require Greater Attention to Critical 
Success Factors," and the opportunity to discuss the issues in this report. 

We agree with the General Accounting Office's (GAO) overall observations that 
the Bureau of Customs and Border Protection (CBP) needs to take adequate 
steps to incorporate factors necessary for Container Security Initiative (CSI) and 
Customs Trade Partnership Against Terrorist (C-TPAT) long-term success and 
accountability. We have taken, and will continue to take, prudent steps to 
address these factors. Enclosed are comments specific to the 
recommendations, as well as general and technical comments that relate to 
statements that need to be clarified prior to finalization of this report. 

I appreciate your interest in Customs and Border Protection. If we may offer 
further assistance, please contact me or have a member of your staff contact 
Ms. Cecelia Neglia, Office of Policy and Planning, at (202) 927-9369. 



Yoms4tuly, 




Robert C. Bonner 
Commissioner 



Enclosure 



Vigilance + Service ~k Integrity 
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Response to Audit Recommendations 
GAO Draft Report on CSI and C-TPAT 



What GAP Recommends 

To ensure that CSI and C-TPAT achieve their long-term objectives, GAO 
recommends that the Commissioner of Customs and Border Protection 
(CBP) and the managers for both programs: 

• Develop human capital plans that clearly describe how the programs 
will recruit, train, and retain staff; 

• Expand efforts to develop performance measures that include 
outcome-oriented indicators; and 

• Develop strategic plans that clearly lay out the programs' goals, 
objectives, and implementation strategies. 

Response 

The CBP agrees with the recommendations and will take the appropriate 
steps needed to implement all three recommendations for both CSI and 
C-TPAT. Key actions are listed below for both programs: 

CSI 

• The Office of International Affairs has initiated action on a human 
capital plan by coordinating with the Offices of Field Operations, 
Human Resources Management, and Training and Development to 
develop a program to recruit, train and retain the staff necessary to 
effectively and efficiently carry out the mission of the CSI. 

• The task force operating the CSI program has been in place less than 
a year and was drawn from several different offices in CBP. It has 
perforce been operating without the usual support and development 
branch that is an integral part of a division that would normally be 
developing performance measures. Having said that, we appreciate 
the acknowledgement of our efforts already underway to develop 
performance measures and work is proceeding apace. 

• The strategic vision for CSI was described in an address before the 
Center for Strategic and International Study (CSIS), on January 17, 
2002. As an extension of this vision, Customs determined that the 
initial strategic goal of the CSI to place CSI teams in the top 20 foreign 
ports responsible for about 70 percent of all maritime containers 
shipped to the United States— an unprecedented undertaking. Once 
this phase was underway it was quickly followed by Phase II, which 
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See comment 1 . 



See comment 2. 



expands CSI to other large and strategically, significance ports. While 
the strategy is simple and the mission has been clearly articulated- 
targeting and examining high-risk containers before they are loaded 
on vessels bound for the U.S. - we agree with the need for a more 
detailed strategic plan to support the operation. Work is underway on 
a strategic plan that will clearly outline the goals, objectives and 
detailed implementation strategies. 

C-TPAT 

• The Office of Field Operations is aware of the need to effectively 
deploy its human capital resources to continue the progress of 
C-TPAT. A comprehensive plan is being developed in coordination 
with the Office of Training and Development to engage leading 
universities in creating a college-level curriculum to train the Supply 
Chain Specialists who will be the front line personnel for the C-TPAT 
program. The curriculum will constitute a multi-disciplinary approach 
to logistics management and supply chain security and will incorporate 
continuing education. 

• We are in the process of evaluating current trade compliance 
measurement indicators to incorporate specific discrepancies that 
may serve as "red flags" that highlight potential security problems for 
C-TPAT participants. Measurement of manifest discrepancies, tariff 
heading shifts and misdeliveries will be reviewed as potentially 
relevant indicators of supply chain control. Additionally, findings and 
feedback from C-TPAT participants during the validation process will 
be reviewed as possible bases for measurement. 

While the C-TPAT program will review different avenues for program 
measurement, it must also be noted that the key program indicator for 
C-TPAT is the absence of concealment of terrorist weapons in cargo 
shipments or access to such shipments by terrorist groups. The 
purpose of a security program in this regard is to prevent the 
introduction of potentially destructive material into cargo shipments. 

• Customs has established clear plans and objectives for C-TPAT from 
the program's inception. Before launching C-TPAT, Customs met 
exclusively with the trade community to establish agreed upon 
standards and best practices for improving supply chain security. 
Customs targeted "low risk" importers for enrollment in the program - 
the vast majority of whom signed onto the program. Customs next 
targeted the other key links in the supply chain - carriers, brokers, 
freight forwarders, and maritime port authorities and terminal 
operators. Representative groups were brought in to meet with 
Customs and devise approaches that were logical and effective to 
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increase supply chain security and reduce potential exploitation by 
terrorists. An extremely successful enrollment process ensued. Over 
3,500 companies have signed up to participate in C-TPAT to date. 

To provide critical program oversight and ensure the effectiveness of 
security practices, the C-TPAT validation process was developed and 
implemented. Training on supply chain security and supply chain 
management was provided to the first group of CBP employees 
performing the validations, and as of this writing over 50 validations 
have been initiated. 

Currently, work is underway to develop a formal strategic plan that 
clearly outlines C-TPAT program goals, objectives, and 
implementation strategies. 
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See comment 3. 



Now on p. 3. 
See comment 4. 



Now on pp. 10 and 20. 
See comment 5. 



Now on p. 15. 
See comment 6. 



General Comments 
GAO Draft Report on CSI and C-TPAT 

Many of the estimated budget figures and container data given to the 
GAO in the Fall of 2002 have changed in the past nine months have been 
improved through more accurate data sources. In any event, the 
numbers represent a snapshot at a particular stage and may well be 
different today. However, this does not change the thrust of the picture 
presented. Since the budget numbers were provided, CBP has received 
additional funding from the FY 2003 Wartime Supplemental and other 
congressional add-ons. 

Page 7, 2 nd para: "Customs initially expected that its account 
managers... would recruit new C-TPAT members and assist companies 
with the development of their action plans." Account managers were 
tasked with communicating C-TPAT program specifics to their accounts, 
most notably to companies that had attained "low risk" status for 
commercial compliance. Account Managers were highly successful in this 
endeavor. The C-TPAT staff explored a number of options, including the 
possibility of using account managers to handle certain aspects of C-TPAT, 
but at no time was it certain or probable that the account managers would 
become involved beyond the communication function. 

Page 14, 1 st para: "U.S. Customs may attend inspections, but this is left 
to the discretion of local customs." In fact, U.S. Customs inspectors must 
be able to observe the inspections. It is a central tenet of the CSI concept 
that U.S. Customs inspectors be able to observe and verify the 
inspections. This is accepted by all partner Customs administrations 
before we implement CSI in a foreign port. Likewise, on page 24 the 
sentence that states "Officials from the three foreign customs 
administrations visited told us that, so far, the CSI requests for 
inspections had not been a burden and that they had often invited the CSI 
teams to observe inspections" leaves the false impression that U.S. 
presence at inspections at CSI ports is at the option of the host customs 
administration. We request that the sentence end after the word 
"burden." 

Page 19, 1 st para: "C-TPAT participants are never rejected from the 
program because of an inadequate security profile or for adverse 
information discovered during the review process. On the contrary, 
Customs officials say that they are committed to working with these 
companies, even if there are serious security or trade compliance 
weaknesses." Current policy is that Customs does not reject companies 
that have signed agreements to work with us in C-TPAT. The nature and 
objective of the C-TPAT program requires Customs and the trade to stay 
engaged and avoid the kinds of confrontations that do not serve to 
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See comment 6. 



See comment 6. 



Now on p. 18. 
See comment 4. 



See comment 7. 



Now on p. 18. 
See comment 8. 



Now on p. 25. 
See comment 4. 



increase the security of the international supply chain. Customs does, 
however, withhold benefits when warranted by adverse information or 
identified security weaknesses. Additionally, Customs can reduce 
benefits for less serious matters to encourage the company to rectify a 
security gap or problem. It must also be clearly understood that C-TPAT 
participants are not exempt from Customs trade compliance and 
enforcement activities; in fact many of the systemically controlled criteria 
"override" C-TPAT participation when the issues are serious enough to 
warrant physical examination of cargo or documents reviews. 

Lastly, it must also be noted that Customs has made it clear that if at any 
point during a company's membership we determine (e.g., during the 
validation process) that their commitment is not serious, or intentionally 
misleading, Customs will remove that company from C-TPAT 
membership. 

Page 21, 1" para: "...as Customs realized that its account managers, 
who were on the "front lines" were not prepared to provide companies the 
level of assistance they required, Customs developed a new supply chain 
specialist position to assist with key program elements." As noted 
earlier, account managers were tasked with communicating with their 
accounts about C-TPAT and they successfully carried out this function. 
Additionally, Customs did not "expect" that account managers would 
provide detailed levels of assistance beyond communicating program 
basics. 

Experience gained during the review and evaluation of security profiles 
submitted by C-TPAT participants indicated that a specialized skill set 
would be required to further implement and expand C-TPAT in the future. 
Customs therefore developed the new supply chain specialist position to 
assist with key program elements. 

Page 22, 1" para: This paragraph appears to tie the 24-Hour Rule to the 
CSI in a way that may be misleading. Certainly the 24-Hour Rule is a 
critical element to the success of CSI. However, the rule was developed 
concurrently with CSI to enhance our ability to target both abroad and 
upon arrival in the U.S. 

Page 26, 3 rd para: "Initially, Customs expected that its account 
managers... could promote the program and help companies develop 
action plans." Once again, account managers were tasked with 
communicating with their accounts on C-TPAT. Account manager 
involvement was one of many options explored for the further 
implementation of C-TPAT - as noted earlier it was neither certain nor 
probable that account managers would shoulder primary responsibility. 
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Now on p. 25. 
See comment 9. 



See comment 10. 



Now on p. 30. 
See comment 1 1 . 



Now on p. 32. 
See comment 12. 



Page 29, 2 lxl para: "However, given the need to complete over a 
thousand validations and establish accountability, the C-TPAT officials 
most recently told us, the specialists would focus on conducting 
validations, making other program elements a lower priority." The 
validation process will in fact encompass the key program elements and 
priorities of C-TPAT, such as the development of action plans and 
assessment of security improvements. The primary priority of C-TPAT is 
a secure supply chain and the validation process is designed to ensure 
that priority is met. 

Page 35, 2 nd para: The second full paragraph appears to be a repeat of 
the first paragraph. Notwithstanding the assertion is made that Customs 
does not track the contributions made by foreign customs administrations 
in determining whether a particular container should be targeted or 
inspected. This is not accurate. Our weekly statistics report gathers data 
regarding the containers targeted by Automated Targeting System (ATS) 
but that were not inspected because of information received from the host 
customs administration. We recognize that the system we use for 
tracking this information is not as robust as we would like, and we are 
modifying ATS and Automated Manifest System (AMS) to better capture 
that information. 

Page 37, 1 st para: The lead paragraph about our lack of strategic 
planning leaves the impression that U.S. Customs imposed unnecessary 
demands on private industry in France that was negated by the 
implementation of the 24-Hour Rule. This is false. With the advent of 
CSI in Le Havre, in November 2002 French Customs updated an existing 
program and required 36 data elements to be electronically filed 24 hours 
before the goods arrive at the port. These data elements are collected 
from carriers, exporters, brokers and freight forwarders and create a 
"Declaration de Surete" (DS) on the goods for French Customs. This is 
an enhancement to a system that the French had been operating in 
Le Havre for a number of years. By contrast the U.S 24-Hour Rule 
requires only 15 data elements, and only from carriers, prior to loading f or 
export (which is after arrival of the goods at the port). The two systems 
complement and validate each other to the extent that goods arriving in 
the port are destined to leave for the U.S. This proactive security 
measure imposed by the French actually allows our CSI team to have 
information about U.S.-bound goods up to 72 hours prior to lading for 
departure, a significant benefit not realized in any other port. In addition, 
this situation has allowed us to accept the French intelligence service 
provider, Soget, as the first foreign AMS service provider. Soget will 
receive carrier, broker, importer and freight forwarder data and transmit it 
to the appropriate French or U.S. Customs administration to meet the OS 
or 24-Hour Rule requirements. This also has paved the way for several 
providers to Customs in other countries to also accept and meet our AMS 
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requirements for service providers. It is true that all this was not 
envisioned in strategic planning before we implemented CSI in Le Havre. 
Nevertheless, the net result is a benefit for the program, multiple CSI 
partners, and our strategic vision. We do not agree that this "... caused 
French customs officials to impose unnecessary demands on private 
industry shipping out of Le Havre. . . " We propose that the paragraph be 
revised or deleted. 
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The following are GAO's comments on the letter from the Bureau of 
Customs and Border Protection, dated July 16, 2003. 1 



GAO Comments Customs agreed with our findings that human capital planning is 

needed, and Customs indicated that it is developing a comprehensive 
training plan for Customs-Trade Partnership Against Terrorism 
(C-TPAT). However, while training is an important aspect of human 
capital planning, our report shows that human capital plans should also 
systematically address other long-term staffing needs, such as 
recruitment and retention for the more than 150 supply chain 
specialists Customs plans to hire. 

2. Customs commented that it is making progress in developing further 
performance measures that are based on trade compliance data. As our 
report states, to ensure that C-TPAT performance indicators are 
reliable, the measures should compare trade compliance data for 
companies before and after they enroll in the program. Customs also 
indicated that it intends to review the results of the validation process 
in order to develop possible baselines for measurements. These efforts 
are responsive to the recommendation in our report. 

3. Customs noted that more accurate budget data are available. Between 
the fall 2002 and June 2003, we requested clarification and updated 
budget information for our report. Our report presents the budget data 
that Customs provided us. Furthermore, we did not use the fall 2002 
container data in our report; our report presents the number of ocean 
containers inspected under the Container Security Initative (CSI) 
program through May 2003, which was provided by Customs officials in 
June 2003. 

4. Customs raised several concerns about our characterization of the 
expected role of account managers in C-TPAT. Customs indicated that 
"at no time was it certain or probable that account managers would 



x On March 1, 2003, the U.S. Customs Service was transferred to the new Department of 
Homeland Security. The border inspection functions of the Customs Service, along with 
other U.S. government agencies with border protection responsibilities, were organized into 
the Bureau of Customs and Border Protection. Throughout this report, we used the term 
"Customs" to refer to both the Customs Service and the Bureau of Customs and Border 
Protection. 
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become involved beyond the communication function." This statement 
contradicts previous statements by Customs officials and an early C- 
TPAT program document that account managers would be involved in 
developing action plans. Therefore, we maintain that Customs account 
managers were initially expected to help companies develop action 
plans. 

5. Regarding Customs' assertion that U.S. Customs inspectors must be 
able to observe inspections at CSI ports, we do not question the need 
for Customs inspectors to make such observations. However, our 
analysis of the bilateral arrangements show that the arrangements do 
not specify that U.S. Customs must be able to inspect containers or 
observe inspections. In addition, our analysis of Customs' documents 
and our discussions with Customs officials reveal that bilateral 
arrangements with foreign governments are not legally binding 
documents. We will not revise the sentence that states "Officials from 
the three foreign customs administrations visited told us that, so far, 
the CSI requests for inspections had not been a burden and that they 
had often invited the CSI teams to observe inspections" because this is 
what foreign customs officials told us. However, we will revise the 
report to clarify that the ability of the U.S. Customs officials to observe 
and verify inspections is a central tenet of the CSI concept and, 
according to U.S. Customs officials, all partner Customs 
administrations accept this tenet. 

6. Customs stated that company participants are not rejected from the 
program and are instead engaged by C-TPAT to increase the security of 
the international supply chain. This statement is consistent with 
information in our report. Customs also noted that it withholds 
benefits when this action is warranted by adverse information or 
identified security weaknesses and that it can reduce benefits, for less 
serious reasons, to encourage a company to rectify a security gap or 
problem. We revised the report to clarify these two points. We also 
added a footnote to capture Customs' comments that C-TPAT 
participants are not exempt from Customs trade compliance and 
enforcement activities. We further revised the report to clarify that 
Customs can remove a company from C-TPAT membership if it 
determines that the company has not made a serious commitment or 
has intentionally misled Customs. To date, Customs reported that it has 
not removed a company from C-TPAT membership. 
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7. Customs noted the evolution of the supply chain specialist position. 
This is consistent with our report. 

8. We believe that our portrayal of the relationship between the 24-Hour 
Rule and CSI is accurate. Our report states that the 24-Hour Rule was 
implemented to ensure that Customs would obtain complete and timely 
manifest data. This is based on specific evidence found in our 
examination of the 24-Hour Rule, as published in the Federal Register. 
The 24-Hour Rule, as found in the Federal Register, specifically states, 
under the heading Necessity for Advance Presentation of Vessel Cargo 
Manifest to Customs, that "CSI is already operational in Canada and the 
Netherlands. . ..Given this explosive growth, it is critical that the 
information necessary to implement CSI fully be provided to Customs 
in the near term. For this reason, Customs proposed this rulemaking 
on August 8, 2002." 

9. Customs noted that the development of action plans and assessment of 
security improvements are part of the validation process. In earlier 
interviews with Customs officials, we were told that supply chain 
specialists would focus on validating the company security profiles, 
because Customs needed to validate the large number of security 
profiles that they had received. We revised the report to eliminate the 
statement that other program elements would be a lower priority and 
clarified that supply chain specialists would focus on validations and 
action plans. We also added that supply chain security specialists 
would help facilitate the annual assessments. 

10. We have deleted the second paragraph. 

11. Customs noted that the statement in our report that Customs does not 
track the contributions made by foreign customs administrations in 
determining whether a particular container should be targeted or 
inspected is inaccurate. We revised the report to reflect that Customs 
does not analyze statistics to ascertain the nature and extent of the 
contributions made by foreign customs administrations in determining 
whether a particular container should be targeted or inspected. 

12. We disagree with Customs' assertion that our report implied that U.S. 
Customs imposed unnecessary demands on private industry. To the 
contrary, our report states that French Customs imposed demands on 
private industry that proved unnecessary. However, our central point 
still stands. French Customs officials told us that they updated their 
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manifest system in anticipation of the implementation of CSI in the port 
of Le Havre, but without knowledge of the imminent implementation of 
the 24-Hour Rule. In our interviews with French Customs officials, they 
expressed dissatisfaction with the confusion surrounding the 
implementation of the 24-Hour Rule. That benefits derived from 
French Customs' efforts to update the manifest system is beside our 
point that good communication is vital between CSI partners. 
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